Using a custom script input I can obtain some data from a particular network resource. I would like to know if is possible to inject/append a field to the generated event indexed by splunk , so that I can augment my knowledge about each event.
One approach would be to leverage lookups. Checkout: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources?r=sear...
You can create field=value pairs on the the fly to augment knowledge about your events.
Interesting, but there seems to be a limitation.
If I understood correctly, one can create new fields/values , but they must be somehow related to the event through an field that is already contained by the event.
I need to add/inject a field=value pair to my event , that is completely unrelated to any of it's fields.
And I need to do it on the fly . Is there any possibility to allow me to do this